Activity timeline
T1069.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 8 reports, and 10 of the 10 threats were reported in the twelve months to 2026-07.
How adversaries use it
T1069.001 Local Groups is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix, as a sub-technique of T1069 Permission Groups Discovery. Threadlinqs maps 10 of 2623 tracked threats (0.4%) to it; by severity that is 1 critical, 7 high, 2 medium.
Threats that use T1069.001 most often also use T1071.001 Web Protocols (8 threats), T1082 System Information Discovery (8 threats), T1105 Ingress Tool Transfer (8 threats), T1033 System Owner/User Discovery (6 threats), T1036.005 Match Legitimate Resource Name or Location (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
11 tracked threat actors appear in the threats that use T1069.001; the most frequent are ALPHV (2), BlackCat (2), Akira (1), Cavern Manticore (1), Contagious Interview cluster (1).
Data sources
Telemetry that can reveal T1069.001, per MITRE ATT&CK.
- Command — Command Execution
- Group — Group Enumeration
- Process — OS API Execution, Process Creation
Threat actors using it
Tracked threats
10 tracked threats use T1069.001.
- BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys via Sphynx Encryptor to Mass-Encrypt Cloud Storagehigh
- SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize…high
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demandsmedium
- SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machineshigh
- LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day…high
- EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver…high
- Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion…medium
- Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via…high
- Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing SEO Poisoning (TB36726/PR40373)critical
- Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and…high
Detection coverage
Threadlinqs maintains 11 detection rules mapped to T1069.001 (SPL 3, KQL 4, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1069 Permission Groups Discovery — 101 tracked threats at the technique level.